sendsafe | 676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4 | Triage

Analysis

max time kernel
146s
max time network
163s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 04:40

Sharing

Report Analysis Logs

General

Target

676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe
Size

1.8MB
MD5

3b06a29a97cc177e0ead020232757c49
SHA1

f866cb89ead83d13ad49573ef4f2671c4caa967d
SHA256

676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4
SHA512

e4077465f6aeb45c23ba8bc17c076bb03459b1c9266aa9c813b63c6a5b553e349c7fbb38fadec54edd471cbec1f7e7f823ab0dafe759994bf120e0f454f061dd

Score

10^/10

sendsafe unregistered botnet spam

Malware Config

Extracted

Family

sendsafe

Botnet

UNREGISTERED

C2

31.44.184.32:50069

31.44.184.32:50070

Attributes

service_name
Enterprise Mailing Service

Signatures

SendSafe
SendSafe is a notorious spam tool which then turned into spam botnet.
spam botnet sendsafe

SendSafe Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1840-55-0x0000000000400000-0x00000000005D5000-memory.dmp	sendsafe
behavioral1/memory/1840-56-0x0000000000400000-0x00000000005D5000-memory.dmp	sendsafe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe

pid process

1840 676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe

pid process

1840 676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe

C:\Users\Admin\AppData\Local\Temp\676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe
"C:\Users\Admin\AppData\Local\Temp\676f015fb666105fff33ae26909a1b80155eeeacdc6fa6454d6732ebe1400fd4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-54-0x0000000001F40000-0x00000000020F2000-memory.dmp

Filesize
1.7MB

Download
memory/1840-55-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/1840-56-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download